Summary

  • RFC 3478 allowed MPLS forwarding entries and label-FEC bindings to survive an LDP restart as stale state while control-plane meaning was reconstructed.
  • Reconnect, liveness, recovery and holding timers—and a ban on early label reuse—made that continuity a bounded loan rather than proof of recovery.

Graceful restart is an optimistic phrase. It suggests a system that stops, gathers itself and returns without consequence. RFC 3478 described a more conditional bargain. The forwarding plane could keep moving packets while the LDP component of the control plane forgot and rebuilt what those movements meant.

The document made a deliberately minimal assumption. An LSR capable of preserving MPLS forwarding state did not also have to preserve all LDP state. What survived could be no more than a mapping from an incoming label to an outgoing label and next hop, or, at ingress, from a FEC to an outgoing label and next hop. That was enough to avoid immediately disturbing an established LSP. It was not enough to say the control plane was whole.

The distinction matters because old forwarding and new knowledge could coexist. After restart, the LSR marked preserved entries stale. A newly received Label Mapping could confirm an entry by matching the outgoing label and a next hop learned from the peer. Depending on whether the router was transit, penultimate hop or egress, the join also had to account for label pop and sometimes the FEC itself. State stopped being stale only when the rebuilt protocol supplied the required match.

RFC 3478 also offered an alternative procedure in which a restarting LSR might temporarily hold two local bindings for the same FEC: one retained from before restart and one created afterward. They shared the same outgoing label and next hop, and the retained binding disappeared at the end of restart. Continuity therefore did not imply singular control-plane truth at every instant.

Time governed the bargain. The FT Session TLV in the LDP Initialization message carried an FT Reconnect Timeout and a Recovery Time. The first told a peer how long the sender wanted old forwarding associated with their failed communication to remain. The second told peers how long a restarting LSR was willing to retain forwarding state it had actually preserved.

Zero had precise meaning. A sender advertising a zero FT Reconnect Timeout would not preserve its own forwarding state, although it could still act as a helper for a neighbor. A restarting peer advertising zero Recovery Time said its preserved MPLS forwarding state was not available. In that case, retained stale bindings were to be removed rather than treated as a grace period.

Local policy shortened the advertised promise. Before reconnection, a helper kept stale bindings for the lesser of the peer's FT Reconnect Timeout and its own Neighbor Liveness Timer. After successful reconnection with non-zero Recovery Time, retention was bounded by the lesser of that Recovery Time and a local Maximum Recovery Time. The restarting router had its own MPLS Forwarding State Holding timer; entries still stale when it expired should be deleted.

These were not redundant clocks. They expressed different authorities. A peer proposed how long it needed. A local operator limited how long it would believe that proposal. A restarting box limited its own preserved entries. The actual trust window was the intersection, not the largest number in a packet.

The specification recommended exchanging label mappings within half the Recovery Time. But a re-established TCP session was not itself proof that every mapping had arrived, and RFC 3478 carried no explicit completion marker. RFC 5919 later introduced End-of-LIB Notification in part to signal when label advertisement was complete. That later instrument clarifies the evidence gap; it must not be read backward as a field present in 2003.

Label reuse formed the safety wall around the timers. If a downstream LSR released a label and gave the same numeric value a new meaning while an upstream neighbor still forwarded under the old meaning, packets could reach an unintended destination. RFC 3478 therefore said a released label should not be reused toward a graceful-restart neighbor for at least the sum of FT Reconnect Timeout and Recovery Time. The quarantine protected meaning, not merely the number.

The security section showed how adversarial the timing could become. An impersonator or interceptor that forced Recovery Time to zero could cause a peer to release labels. The opposite failure was equally dangerous: one side might consider a session failed and reuse a platform-wide label while the other still transmitted using the old association. Authentication mattered, but the operational evidence still had to show what each side believed and when.

Traffic continuity is therefore a useful but narrow receipt. Packets passing during restart can show that some forwarding entries survived and remained usable for those packets. They do not prove that every FEC was refreshed, that the new LDP session reconstructed the old LIB, that protocol ownership was preserved where BGP or RSVP-TE also assigned labels, or that the label would remain safe after the final timer expired.

Heng Lu's reality-layer discipline supplies the audit order. Begin with the old and new LDP session identities, TCP failure and reconnection, FT Session TLVs and all local timer configuration. Inventory forwarding entries separately from LIB entries. Record when each became stale, which Mapping and peer address refreshed it, whether its label changed, when it was deleted and whether the numeric label stayed quarantined.

Only then join packet observations. A no-loss graph is not a reconstruction log. A green session is not End-of-LIB. A non-zero Recovery Time is a claim about retained state, not a measurement of it. A stale entry that still works is still stale until the required control evidence refreshes it.

RFC 3478 belongs in Internet history because it made continuity depend on disciplined doubt. It allowed the data plane to outlive its control narrative, but only temporarily. The old labels kept forwarding on borrowed time, and the protocol's real achievement was to define who could extend that loan, who could shorten it and when the old meaning had to disappear.

Sources